Human-Led AI-Augmented
Penetration testing services for Web, Mobile, API, and Network with verifiable evidence and actionable remediation guidance
Siam Thanat Hack certifications
If the player is blocked, open the video on YouTube
OFFENSIVE SECURITY / 01
Find exploitable vulnerabilities with evidence and practical remediation.
01 / WEB APPLICATION PENETRATION TESTING
Test web applications for exploitable vulnerabilities, including business logic flaws scanners miss.
Executive and technical reports with evidence, reproduction steps, impact, remediation, and scoped retesting.
02 / MOBILE APPLICATION PENETRATION TESTING
Test both the app and backend/API against the OWASP Mobile Top 10 to find exploitable vulnerabilities.
Reporting and recommendations for both application and backend, a results briefing, and retesting within the agreed scope.
03 / API PENETRATION TESTING
Find authentication, authorization, rate-limiting, and data-exposure vulnerabilities in REST and GraphQL APIs.
Endpoint-level reporting with evidence, reproduction steps, impact, and developer-ready recommendations.
04 / NETWORK PENETRATION TESTING
Test external and internal networks within the mutually agreed scope and Rules of Engagement.
Executive and technical reporting with network-segmentation evidence and scoped retesting.
05 / SECURE CODE REVIEW
Manually analyze source code for vulnerabilities and logic flaws with practical remediation.
Reporting with file/line locations, impact, fixes, and architectural guidance where needed.
06 / VULNERABILITY RESEARCH
Research binaries, protocols, or codebases that require more than conventional checklist testing.
An advisory with proof of concept, risk prioritization, impact, and mitigation guidance.
Humans define scope and validate every finding. Within the authorized scope, AI runs automated active testing to increase speed, coverage, and efficiency against techniques real attackers may use.
ASSESSMENT GUIDE
Each assessment answers a different question. Choose according to the objective, scope, and evidence you need; they are not automatic substitutes for one another.
01 / VA SCAN
Broadly discover and prioritize vulnerabilities. Scanner-only VA does not replace a Pentest.
Choose it when: You need an initial assessment of a large network environment, broad visibility of many vulnerabilities, and a plan for deeper validation.
02 / PENTEST
Experts use manual testing to validate exploitability and impact within the agreed scope.
Choose it when: You need evidence that vulnerabilities are exploitable and remediation guidance for critical Web and Mobile applications.
03 / RED TEAM
Simulate objective- and threat-led scenarios under explicit Scope and Rules of Engagement to assess prevention, detection, and response objectives.
Choose it when: You already run VA and Pentest regularly and need to test how people, processes, and technology respond to a defined scenario.
Scroll horizontally to view every column
| VA Scan | Pentest | Red Team |
|---|---|---|
|
||
* Targets the stated objective, such as taking over a Domain Controller or implanting a backdoor while evading SOC detection, rather than seeking the greatest possible number of vulnerabilities. |
||
|
||
* Excludes vulnerabilities that could affect business continuity. |
||
|
||
* Testing focuses on non-production systems to reduce impact. |
* Focuses on testing detection and response processes. |
|
ABOUT STH / 02
STH is a Thai white-hat team in Bangkok, combining deep expertise, operational discipline, and auditable communication.
Incorporated on 11 December 2018 with registered headquarters in Don Mueang and operational office near MRT Phra Ram 9, Bangkok.
STH received the winner award at Thailand Cyber Top Talent 2023
A hands-on workshop with the SCBX technology team
Practice analyzing applications, devices, and security behavior together
Contributing to a CTF bootcamp that advances cybersecurity skills
Threat analysis and response skills proven through competition
Applying penetration-testing expertise to design a competition platform that supports the fight against cybercrime
Use the BOT Notification 4/2568 control baseline for the Mobile Application, API/backend, authentication, and transaction flow; where biometrics are used, assess PAD/liveness and biometric-data protection
Validate application behavior across diverse devices and operating systems
CyberSec Asia × Thailand International Cyber Week 2025
PAD testing under the Bank of Thailand's biometric authentication guidance
Biometric Technology guideline, B.E. 2566 (2023)Guideline B.E. 2566 Biometric Technology guideline, B.E. 2563 (2020)Guideline B.E. 2563
01
STH grew from knowledge sharing. Former operators of the Facebook page Longhackz then expanded into CTF competitions, challenge creation, vulnerability research, and high-difficulty technical advisory work.
02
Our specialists have worked on critical systems for banks, payment gateways, and leading organizations. We work strictly within an authorized scope and Rules of Engagement. We do not perform unauthorized access, account hacking, or account recovery.
03
Humans define scope and validate every finding. Within the authorized scope, AI runs automated active testing to increase speed, coverage, and efficiency against techniques real attackers may use.
Within the authorized scope, we use AI for reconnaissance and automated attack testing to explore the attack surface and test hypotheses faster. Specialists define scope, control testing, reproduce findings, assess impact, and approve the final report.
Passionate about offensive security and eager to grow with our team? Explore our open positions
HUMAN-LED × AI-AUGMENTED / 03
Experts define scope, control testing, and validate results while AI runs automated active testing within scope to increase speed and coverage.
Human owns the decision
Evidence from the real surface
AI tests actively; humans retain authority
DELIVERY FLOW / 04
Every phase has a clear owner, evidence, and decision gate.
Phase 01 details
Turn business objectives into a clear, safe, and authorized testing scope before work begins.
Phase 02 details
Build a threat model and attack-surface map to prioritize likely, high-impact attack paths.
Phase 03 details
Perform authorized manual offensive testing to validate vulnerabilities and connect them into attack chains.
Phase 04 details
Recheck results to remove false positives, define affected scope, and assess risk from proven evidence.
Phase 05 details
Turn test results into prioritized, actionable information for executives and technical teams.
Phase 06 details
Retest under the original conditions, check related bypasses or variants, and verify that risk is genuinely reduced.
Timelines are estimates and may change with scope, access, and Rules of Engagement.
VERIFIABLE TRUST / 05
Download our certificates and review the principles behind our delivery.
Every finding is reproduced and manually validated
Evidence, reproduction steps, impact, and remediation are included
AI is an automated testing layer; humans decide the test results
Verify remediation and deliver evidence according to the package or scope
START THE CONVERSATION / 06
Send us your initial system details, testing scope, and preferred timeframe so we can prepare an assessment plan.
PENTEST FAQ / 07
Answers about scope, pricing, timelines, and regulatory requirements. If you cannot find what you need, talk to the team directly.
A VA Scan uses tools to discover vulnerabilities across a wide scope, which suits health-checking many systems and prioritizing risk first. A Pentest is hands-on testing by specialists to prove whether vulnerabilities are actually exploitable, with evidence and remediation guidance. Systems that are business-critical or hold customer data should get a Pentest alongside periodic VA, as one does not replace the other.
The STH team has hands-on experience testing the applications of leading financial institutions and holds internationally recognized certifications at both the organizational level and the level of the individual specialists who run the tests, and were champions of Thailand Cyber Top Talent 2023. We support your engagement from start to finish: advising at the outset, preparing before testing, communicating vulnerabilities as they are found, and giving careful guidance on closing them.
Our work is human-led. Specialists define the scope, do the actual exploitation, and manually validate every finding before it reaches the report. We use AI and automated tools to speed up reconnaissance and widen coverage within the authorized scope, but the work a scanner cannot do, including chaining vulnerabilities into a real attack and testing business logic, IDOR, and authentication, stays with our experts. You get proof of real, exploitable impact with false positives already removed, not a ready-made scanner report.
Pricing follows the scope: how many systems, the size of each application, the number of functions or API endpoints to test, and the testing model (black-box, gray-box, or white-box). Send us your system details and the team will estimate the effort in man-days and issue a quotation with a clearly defined scope before any work begins.
It depends on the system's size and complexity. A single application typically takes about one to three weeks including reporting. After your team fixes the findings, we schedule a retest round to confirm the remediation.
A full report with an executive summary and technical detail. Every finding includes reproduction steps, evidence, a CVSS-based risk rating, and practical remediation guidance. You also get direct access to the testers for questions, and a retest report after fixes.
Several industries have direct requirements, including financial institutions under Bank of Thailand rules, securities and digital asset businesses under the Thai SEC, and card systems under PCI DSS. PDPA and the Cybersecurity Act define risk-based security duties instead. Some cite OWASP guidance directly, such as clause 6.2.2 of the Website Security Standard B.E. 2568 and Bank of Thailand notification SorNorChor 1/2564. We summarize each authority's requirements, with links to the source documents, at Regulations & standards
Mainly, help us define the scope: the list of systems, URLs or app builds, test accounts for each user role, and the time window that suits you. We then prepare the scope and Rules of Engagement document for written sign-off before work begins.
All testing happens within a written, authorized scope under a non-disclosure agreement. STH is certified to ISO/IEC 27001:2022 and ISO 9001:2015, which govern how evidence is handled, stored, and delivered throughout the project.
